1540645 - Add Web IDL constructor for signature verifier

Status: NEW

(Core :: Security: PSM, enhancement, P3)

Description

[Mathieu Leplatre [:leplatrem]]

Currently we can't execute the signature verification in a Web worker because the Web interface does not exist.

    const verifier = Cc["@mozilla.org/security/contentsignatureverifier;1"]
      .createInstance(Ci.nsIContentSignatureVerifier);

    let valid;
    try {
      valid = verifier.verifyContentSignature(
        serialized,
        builtSignature,
        certChain,
        "normandy.content-signature.mozilla.org"
      );
    }

Could become:

// worker.js

importScripts("resource://gre/modules/content-signature-verifier.js");

ContentSignatureVerifier.verifyContentSignature(
    serialized,
    builtSignature,
    certChain,
    "normandy.content-signature.mozilla.org"
);

Comment 1

[Michael Cooper [:mythmon]]

I believe that the signature verifier relies on code that can't currently run off-main thread, so this isn't as simple as adding a definition for the interface. I think this work might already be tracked elsewhere. Dana, can you comment on this?

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Currently this would depend on figuring out the threading issues with the implementation in bug 1534600.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Landing bug 1541942 removed threading restrictions, so this should be easier now (although bug 1534600 would still be helpful in that it would be nice to have an asynchronous API here).

Comment 4

[Mathieu Leplatre [:leplatrem]]

Attachment: Bug 1540645 - Add Web IDL constructor for signature verifier